Tomcat 6.0.18, Version 1 Cookies, Acegi Remember Me, and IE

I’ve got to write all this out hoping that it’ll bring some clarity to what I’m seeing, here’s the stage:

Tomcat 6.0.16 changed the way that cookies are sent from the server to the browser IF the cookie value contained any of the following characters: “()<>@,;:\\\”[]?={} \t”, the change being that if you attempt to set a cookie while inside an application deployed in Tomcat 6.0.16, the cookie value would get wrapped in double quotes and the cookie version would get set to 1. All fine and dandy.

Except that as part of the fix, someone decided that the path part of the cookie should also get wrapped in double quotes and IE6 and IE7 don’t like that, in fact they’ll ignore cookies where the value of the path attribute is quoted, which led to this bug getting filed and fixed as part of the 6.0.17 release.

At least they thought it was fixed, here’s what I’m seeing: if you set a cookie that contains any of the above mentioned characters (let’s say that hypothetically you’re using the TokenBasedRememberMeServices class, itself part of Acegi, that sets a cookie whose value is the Base64 encoded representation of your username, an expiration time and another string, long story short the value ends up looking something like this: YWFyb246MTIyODI0ODEwMjk5NjoyOGM5ODc4YzExOGZiOGZjZTBkZDE0ZTA1ZWRhZTM3Nw==) then Tomcat will end up wrapping the cookie value in quotes, will set the Version to 1 and … well, did you know that when you set the version of a cookie to 1 that the cookie looks different? Here’s Tomcat setting the cookie pre-6.0.16:

See the three changes? The cookie value is quoted, the version attribute was added and … hey, look at that, the expires attribute turned into the max-age attribute. I guess that’s cool right? I mean all browsers should support RFC-2109 (which was published in 1997 and then superseded by RFC-2965), right? Well, it looks like (and this is where I’m hoping someone will prove me wrong) neither IE6, nor IE7, nor Safari honor the max-age attribute which means, drum roll please, you can’t set a persistent cookie on IE6, IE7 or Safari via Tomcat 6.0.18 that contains any of the above mentioned characters. Someone PLEASE prove me wrong.

If I’m right (and this Citrix KB doc seems to back up the IE6 / IE7 behavior I’m seeing), anyone that has deployed an Acegi-based Java web application that uses the default TokenBasedRememberMeServices on the latest version of Tomcat is 100% screwed. I’m not sure who to blame more: IE for being the lamest browser ever (although Safari doesn’t seem to like Max-Age either) or Tomcat for changing (in a pretty big way) the way they publish cookies in a point release.

Post navigation

I am running into the same issue now w/ Tomcat 6.0.18 so it is not just you. I’m upgrading an app from Tomcat 4.x, and looking the cookies set by Tomcat 4 use ‘Expires’ while Tomcat 6 is using ‘Max-Age’ – which as you said freaks IE out…

I’ve done some additional research on this, and it seems that the only current workaround is to write the ‘Set-Cookie’ header yourself, adding the ‘Expires=’ parameter as well – even though that renders the cookie non-standard. But FireFox and other browser’s don’t seem to mind the extra parameter being there.

TokenBasedRememberMeServices class, itself part of Acegi, that sets a cookie whose value is the Base64 encoded representation of your username, an expiration time and another string, long story short the value ends up looking something like this: YWFyb246MTIyODI0ODEwMjk5NjoyOGM5ODc4YzExOGZiOGZjZTBkZDE0ZTA1ZWRhZTM3Nw==) then Tomcat will end up wrapping the cookie value in quotes, will set the Version to 1 and â€¦ well, did you know that when you set the version of a cookie to 1 that the cookie looks different? Hereâ€™s Tomcat setting the cookie pre-6.0.16:

Now with 50% less caffeine!

What’s Going On Here?

My name is Aaron Johnson and I created this blog both for me (mostly) and sometimes you. I've been saving my deliciouspinboard.in links here and blogging since 2002. During the week (and at night and some weekends and well.. most of the time), I work in engineering at Jive Software. When I'm not working, I'm hanging out with my amazing wife, our dinosaur Star Wars loving son three boys and four chickens in the burbs outside of Portland, Oregon.